On Παρ, Σεπ 07 2018 at 02:39:30 μμ, Alan DeKok <aland@deployingradius.com> wrote: Hi again,
Is this a bug (looks like to me), feature, or am I missing something?
It's *fixing* a bug.
Could I do something with unlang, or in the ldap module config in this case?
Map the LDAP userPassword attribute to a binary attribute, e.g. Tmp-Octets-0. Then, copy that to Cleartext-Password:
ldap if (control:Tmp-Octets-0) { update control { Cleartext-Password := &control:Tmp-Octets-0 } }
quickly tried your proposed fix in production. Did not seem to work: (33318) Fri Sep 7 15:41:31 2018: Debug: Received Access-Request Id 249 from 79.128.178.33:52087 to 79.128.178.43:1812 length 140 (33318) Fri Sep 7 15:41:31 2018: Debug: User-Name = "kzorba1@otenet.gr" (33318) Fri Sep 7 15:41:31 2018: Debug: NAS-Port-Type = xDSL (33318) Fri Sep 7 15:41:31 2018: Debug: User-Password = "test123\\" (33318) Fri Sep 7 15:41:31 2018: Debug: NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" (33318) Fri Sep 7 15:41:31 2018: Debug: Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" (33318) Fri Sep 7 15:41:31 2018: Debug: NAS-Port = 12234455 (33318) Fri Sep 7 15:41:31 2018: Debug: # Executing section authorize from file /opt/freeradius-auth-3.0.17/etc/raddb/sites-enabled/MYSERVER (33318) Fri Sep 7 15:41:31 2018: Debug: authorize { ... (33318) Fri Sep 7 15:41:31 2018: Debug: ldap_1: Processing user attributes (33318) Fri Sep 7 15:41:31 2018: Debug: [ldap_1] = updated ... (33318) Fri Sep 7 15:41:31 2018: Debug: if (control:Tmp-Octets-0) { (33318) Fri Sep 7 15:41:31 2018: Debug: if (control:Tmp-Octets-0) -> TRUE (33318) Fri Sep 7 15:41:31 2018: Debug: if (control:Tmp-Octets-0) { (33318) Fri Sep 7 15:41:31 2018: Debug: update control { (33318) Fri Sep 7 15:41:31 2018: Debug: } # update control = noop (33318) Fri Sep 7 15:41:31 2018: Debug: } # if (control:Tmp-Octets-0) = noop ... (33318) Fri Sep 7 15:41:31 2018: Debug: [pap] = updated (33318) Fri Sep 7 15:41:31 2018: Debug: } # authorize = updated (33318) Fri Sep 7 15:41:31 2018: Debug: Found Auth-Type = PAP (33318) Fri Sep 7 15:41:31 2018: Debug: # Executing group from file /opt/freeradius-auth-3.0.17/etc/raddb/sites-enabled/MYSERVER (33318) Fri Sep 7 15:41:31 2018: Debug: Auth-Type PAP { (33318) Fri Sep 7 15:41:31 2018: Debug: pap: Login attempt with password (33318) Fri Sep 7 15:41:31 2018: Debug: pap: Comparing with "known good" Cleartext-Password (33318) Fri Sep 7 15:41:31 2018: ERROR: pap: Cleartext password does not match "known good" password (33318) Fri Sep 7 15:41:31 2018: Debug: pap: Passwords don't match (33318) Fri Sep 7 15:41:31 2018: Debug: [pap] = reject (33318) Fri Sep 7 15:41:31 2018: Debug: } # Auth-Type PAP = reject (33318) Fri Sep 7 15:41:31 2018: Debug: Failed to authenticate the user (33318) Fri Sep 7 15:41:31 2018: Debug: Using Post-Auth-Type Reject (33318) Fri Sep 7 15:41:31 2018: Debug: # Executing group from file /opt/freeradius-auth-3.0.17/etc/raddb/sites-enabled/MYSERVER (33318) Fri Sep 7 15:41:31 2018: Debug: Post-Auth-Type REJECT { (33318) Fri Sep 7 15:41:31 2018: Debug: attr_filter.access_reject: EXPAND %{User-Name} (33318) Fri Sep 7 15:41:31 2018: Debug: attr_filter.access_reject: --> kzorba1@otenet.gr (33318) Fri Sep 7 15:41:31 2018: Debug: attr_filter.access_reject: Matched entry DEFAULT at line 11 (33318) Fri Sep 7 15:41:31 2018: Debug: [attr_filter.access_reject] = updated (33318) Fri Sep 7 15:41:31 2018: Debug: } # Post-Auth-Type REJECT = updated (33318) Fri Sep 7 15:41:31 2018: Debug: Delaying response for 1.000000 seconds (33318) Fri Sep 7 15:41:32 2018: Debug: Sending delayed response (33318) Fri Sep 7 15:41:32 2018: Debug: Sent Access-Reject Id 249 from 79.128.178.43:1812 to 79.128.178.33:52087 length 20 (33318) Fri Sep 7 15:41:36 2018: Debug: Cleaning up request packet ID 249 with timestamp +229 Could it be that radclient actually sends '\\' at the end of the password, as shown in the debug output? The ldap stored password contains only a single '\' in the end. PAP comparison therefore seems to fail. Is there a way to send a single '\' at the end of User-password to debug this? Am I again missing something? Regards, Kostas -- Kostas Zorbadelos http://gr.linkedin.com/in/kzorba